CVE-2026-85487

A path traversal vulnerability exists in the HTTP service component of Brocade ASCG versions before 3.5.0. An unauthenticated attacker on the local network could send a manipulated API request to the service endpoint bypassing path restrictions to arbitrary file read, file write, or file deletion operations.

Score

CVSS 3.1 8.8 High

Status

Analyzed - sirt@brocade.com

Published

2026-10-08

Last modified

2026-10-14

Weaknesses

CWE-22

Affected products

• Brocade Active Support Connectivity Gateway (Broadcom)
• Brocade Active Support Connectivity Gateway (Brocade)

References

• https://support.broadcom.com/external/content/SecurityAdvisories/0/38383